Logon load balancing for NAT datacenters

We had this problem of implementing SAP logon load balancing for SAP servers across a firewall and router with...

NAT implemented. The IP address for message server (CI) and app servers, visible from the user location are actually different from the actual physical IP addresses of the machines. There were 2 stages of address translation in router and firewall. In transaction SMLG you can overcome this problem by using the 'attributes' tab in the logon group definition pop-up. Define a logon group and assign an app server to this group. Then go to the attributes tab. In the assignment dependant section, mention the IP address visible by the client for that app server. This is the IP visible outside your datacenter, and is different from the physical IP address of the machine. When user access a logon group, the message server finds out the least loaded app server and send this IP address back to the user. So the user would be connected to that app server.